While W2K does permit global group nesting in native mode, you should still use member local groups as resource groups instead of global groups. If you ever encounter another domain (forest child, or peer, external) you will need to re-permission everything all over again. If you stick to the tried and ture local/global pattern of nesting, you can add trusting domain global groups to your member local groups without any need to add another ACE to the resource.

Steve Billard 9/4/2003 9:30:38 PM

This is an excellent article. The benefit of being able to easily tell what permissions a user has (without examining individual file permissions) cannot be exaggerated.

Nathan Borson 2/6/2001 12:58:04 PM